iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Email can land in Spam even when SPF, DKIM, and DMARC are configured correctly. The receiving provider makes the placement decision using a mix of authentication, sender reputation, complaints, list quality, message content, sending patterns, and recipient or organization policies. Diagnose the affected message and provider first; do not change DNS or rewrite content until the evidence points to that cause.
Start by finding out where the failure happens
First establish whether the message was rejected, delivered to Spam or Junk, or delivered to the inbox and then moved by a recipient-side rule. These are different problems and call for different fixes.
- Ask which recipients are affected: one person, users at one provider, or recipients across multiple providers.
- Save a copy of a message that landed in Spam, including its full headers. Record the recipient provider, approximate delivery time, and whether the message was rejected or accepted into a folder.
- Compare affected and unaffected recipients, if possible. A problem limited to one person may point to a personal rule or blocked-sender setting; a problem limited to one provider may point to that provider’s reputation or filtering decisions.
For Google Workspace senders, Google recommends checking message headers and reports as part of diagnosing delivery problems. Its email sender guidelines also distinguish authentication requirements from inbox placement.
Recommended Free Tools
Check authentication on the message that went to Spam
Open the full headers and inspect the Authentication-Results entry added by the receiving system. Look for results for SPF, DKIM, and DMARC. This shows how the provider evaluated that particular message; a separate DNS lookup or a successful test message does not establish that the affected message passed.
#1 Best Overall
- SonicWall Comprehensive Anti-Spam Service for TZ270 - 1 Year License (02-SSC-6673)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
- SPF: Check whether the sending system was authorized for the domain used in the message’s envelope sender.
- DKIM: Check whether the message has a valid signature and whether it identifies the intended signing domain.
- DMARC: Check whether SPF or DKIM both passed and aligned with the domain visible in the From address.
DMARC passes when at least one of SPF or DKIM is authenticated and aligned with the visible From domain. A message can pass SPF or DKIM without meeting DMARC alignment. Google’s DMARC troubleshooting guidance recommends using headers and reports to investigate failures.
Confirm the sender setup and the applicable Gmail requirements
Correct any failure shown in the affected message before making other changes. Check that SPF includes every authorized third-party sender, and that your custom-domain DKIM signing and sending identity are configured as intended. Microsoft explains how alignment and third-party senders affect DMARC in its Microsoft 365 DMARC setup guide.
Requirements depend on how much mail you send to Gmail. Google’s sender guidelines specify SPF or DKIM for senders generally. Senders sending more than 5,000 messages per day to Gmail are subject to additional bulk-sender requirements: SPF, DKIM, and DMARC. For direct mail in that category, the visible From domain must align with SPF or DKIM. Gmail also requires one-click unsubscribe and a visible unsubscribe link in the message body for marketing and subscribed mail.
Rank #2
- SonicWall Comprehensive Anti-Spam Service for TZ270 - 2 Year License (02-SSC-6674)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
Passing authentication is not an inbox guarantee. Google says authenticated messages are “less likely to be rejected or marked as spam by Gmail,” not that they will always reach the inbox.
If authentication passes, investigate reputation and recipient signals
Authentication establishes aspects of sender identity; it does not establish that recipients want the mail or that the sending domain and IP have a healthy reputation. Review these factors next:
- Complaints: Check whether recipients are marking messages as spam. Microsoft describes junk-mail complaint rate as “One of the principal factors in driving down a sender’s reputation and their ability to deliver email” in its Microsoft 365 mail troubleshooting guidance.
- List quality: Remove invalid addresses and stop sending to people who did not agree to receive the mail. Repeatedly mailing disengaged or unwilling recipients can worsen delivery.
- Reputation: Review the sending domain and IP. A new sending IP may have little history from which a provider can assess it.
- Sending changes: Look for a recent increase in volume, a change of sending infrastructure, or irregular bursts. Google recommends consistent sending and gradual volume increases.
- Engagement signals: Use available provider data to check how recipients interact with the mail; these signals can help explain a placement change even when authentication is sound.
For mail sent to personal Gmail accounts, Google Postmaster Tools provides dashboards for spam rate, IP and domain reputation, feedback-loop data, authentication, encryption, and delivery errors. For Gmail, Google says reported spam rates must remain below 0.3%; this threshold is based on the spam-rate data shown in Postmaster Tools.
Rank #3
- SonicWall Comprehensive Anti-Spam Service for TZ270W - 1 Year License (02-SSC-6679)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
Review message content and subscription practices
Content can contribute to filtering, but no single generic “spam score” or wording change is a reliable fix for every provider. Microsoft lists characteristics such as excessive links, URL shorteners, form tags, embedded scripts, and image-only content as possible filtering concerns in its anti-spam protection FAQ.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsFor marketing or subscribed messages sent to Gmail, verify both the one-click unsubscribe mechanism and a visible unsubscribe link in the body. Also make sure the message is recognizable to the people receiving it and that the audience was collected through an appropriate subscription process. Change content when the message itself presents a plausible issue; do not assume a cosmetic rewrite will resolve a reputation or policy problem.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check provider and organization filtering
If the issue affects Microsoft 365 recipients, an administrator should inspect the message’s X-Forefront-Antispam-Report and Authentication-Results headers, then use Message trace to follow the message through the service. Microsoft identifies bulk classification, mail-flow rules, anti-spam policy settings, and a user’s Blocked Senders list among possible causes. Its anti-spam FAQ describes how to submit a false positive for analysis when filtering appears incorrect.
Rank #4
- SonicWall Comprehensive Anti-Spam Service for TZ350 - 1 Year License (02-SSC-1809)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
Do not start by broadly allowlisting a sender or domain. Microsoft warns that allowlists can let malicious mail bypass filtering. If the mail is delivered to a user’s mailbox but moved to Junk, check that user’s blocked senders and organization rules rather than assuming the sender’s DNS is at fault.
Apply the fix that matches the evidence, then monitor
Make one targeted correction based on what the affected message and provider data show: repair an authentication or alignment failure, remove invalid or unwilling recipients, address a content problem, or correct a recipient-side policy or rule. Then monitor the same provider-specific signals and compare delivery across affected and unaffected recipients.
A DNS correction cannot by itself repair a complaint-rate, reputation, content, or recipient-policy problem. Likewise, changing message wording will not fix a broken authentication setup. Use headers, provider dashboards, and mail-flow records to verify whether the actual cause has changed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
